From cf38a90f12fdd923331cbb300bef551867873e75 Mon Sep 17 00:00:00 2001
From: Sk_Akib_Ahammed <ahammedskakib@gmail.com>
Date: Thu, 8 Jan 2026 11:54:24 +0530
Subject: [PATCH] resolved security issue alerted by Dependabot

---
 app/auth.py          | 32 ++++++++++++++++++++++++--------
 app/firebase_init.py | 14 --------------
 requirements.txt     |  1 -
 3 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/app/auth.py b/app/auth.py
index 3318a42..8d04c17 100644
--- a/app/auth.py
+++ b/app/auth.py
@@ -1,10 +1,13 @@
 # app/auth.py
 
+import os, requests
 from .schema import LoginSchema, SignUpSchema
 from fastapi.responses import JSONResponse
 from starlette import status
 from firebase_admin import auth, firestore
-from .firebase_init import db, firebase
+from .firebase_init import db
+
+FIREBASE_API_KEY = os.getenv("FIREBASE_API_KEY")
 
 def _create_response(status_code: int, message: str, **kwargs):
   content = {"message": message}
@@ -78,14 +81,27 @@ async def auth_login_users(user_data: LoginSchema):
     )
 
   try:
-    user = firebase.auth().sign_in_with_email_and_password(email, password)
-    return _create_response(
-      status.HTTP_200_OK,
-      "Login successful",
-      idToken=user["idToken"],
-    )
+    request_url = f"https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key={FIREBASE_API_KEY}"
+    payload = {
+      "email": email,
+      "password": password,
+      "returnSecureToken": True
+    }
+    response = requests.post(request_url, json=payload)
+    response_data = response.json()
+
+    if response.status_code == 200:
+      return _create_response(
+        status.HTTP_200_OK,
+        "Login successful",
+        idToken=response_data["idToken"],
+      )
+    else:
+      error_msg = response_data.get("error", {}).get("message", "Login failed")
+      return _create_response(status.HTTP_401_UNAUTHORIZED, error_msg)
+
   except Exception as e:
-    return _create_response(status.HTTP_401_UNAUTHORIZED, str(e))
+    return _create_response(status.HTTP_500_INTERNAL_SERVER_ERROR, str(e))
 
 async def verify_staff_access(token: str):
   try:
diff --git a/app/firebase_init.py b/app/firebase_init.py
index 7f9976b..e522c05 100644
--- a/app/firebase_init.py
+++ b/app/firebase_init.py
@@ -3,26 +3,12 @@
 import os
 import firebase_admin
 from firebase_admin import credentials, firestore
-import pyrebase
 from dotenv import load_dotenv
 
 load_dotenv()
 
 IS_CI = os.environ.get("CI") == "true"
 
-firebaseConfig = {
-    "apiKey": os.getenv("FIREBASE_API_KEY"),
-    "authDomain": os.getenv("FIREBASE_AUTH_DOMAIN"),
-    "databaseURL": os.getenv("FIREBASE_DATABASE_URL"),
-    "projectId": os.getenv("FIREBASE_PROJECT_ID"),
-    "storageBucket": os.getenv("FIREBASE_STORAGE_BUCKET"),
-    "messagingSenderId": os.getenv("FIREBASE_MESSAGING_SENDER_ID"),
-    "appId": os.getenv("FIREBASE_APP_ID"),
-    "measurementId": os.getenv("FIREBASE_MEASUREMENT_ID")
-}
-
-firebase = pyrebase.initialize_app(firebaseConfig)
-
 firebase_credentials = os.environ.get("FIREBASE_SERVICE_ACCOUNT")
 
 if not firebase_credentials and not IS_CI:
diff --git a/requirements.txt b/requirements.txt
index e1f7522..80c628b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -47,7 +47,6 @@ pydantic==2.12.5
 pydantic_core==2.41.5
 PyJWT==2.10.1
 pyparsing==3.2.5
-Pyrebase4==4.8.0
 python-dotenv==1.2.1
 python-jwt==4.1.0
 python-multipart==0.0.21